A Cross‑Site Request Forgery flaw in the Wow‑Company Sticky Buttons plugin permits a malicious site to trick a logged‑in user into sending a state‑changing request that modifies the plugin’s settings. The weakness is a form of token‑less request forgery (CWE‑352) and does not provide code execution or escalation of privileges, but it can allow an attacker to alter site behavior, potentially enabling further content injection or hindering site maintenance.

WordPress sites running the Sticky Buttons plugin version 4.1.1 or older are affected. The vulnerability applies to all releases from the initial release through v4.1.1 inclusive.

The CVSS score of 5.4 indicates a medium severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The flaw is not yet listed in the CISA KEV catalog. An attacker would need to coerce an authenticated user to visit a crafted URL or submit a forged form; successful exploitation results in unauthorized alteration of plugin configuration but no direct compromise of the underlying WordPress installation.